masolution
This is a translation. In case of differences, the Dutch version prevails.
Effective date: May 26, 2026
Privacy Statement
Article 1 — About this privacy statement
Maso-IP B.V., trading as MaSolution (hereinafter: “MaSolution”, “we”, “us” or “our”), is a provider of AI-driven services for the hospitality and leisure sector. Through our platform, guests and visitors of our business customers can make reservations, ask questions and communicate by voice, e-mail, chat and SMS.
This privacy statement explains which personal data we process, why, how long we retain it and which rights you have. The statement applies to all persons who contact a hospitality or leisure venue through the services of MaSolution.
MaSolution generally acts as a processor within the meaning of the GDPR, on behalf of the hospitality or leisure venue you contact. That venue is the controller of your personal data. For the services that MaSolution offers itself (such as this platform and the associated communication channels), MaSolution is itself the controller.
Article 2 — Contact details
| Item | Information |
|---|---|
| Registered name | Maso-IP B.V. |
| Trade name | MaSolution |
| KvK number (Dutch Chamber of Commerce) | 42024078 |
| Business address | Biezenstraat 20, 6541ZT Nijmegen |
| E-mail address (privacy) | support@masolution.ai |
| Website | masolution.ai |
Data Protection Officer (DPO): MaSolution has not currently appointed a Data Protection Officer, as the scale of the processing does not yet require this under Article 37 GDPR. MaSolution monitors this on an ongoing basis and will appoint a DPO as soon as this is required by law. For all privacy questions, you may contact us at support@masolution.ai.
Security reports: Have you found a security flaw or vulnerability in our application? Please report it to support@masolution.ai. We take all reports seriously and respond as quickly as possible.
Article 3 — Which personal data do we process?
| Category | Examples | Through which channel |
|---|---|---|
| Identification data | Name, telephone number | Voice, e-mail, chat, SMS |
| Contact data | E-mail address, mobile telephone number | E-mail, chat, SMS |
| Reservation data | Date, time, number of persons, location | All channels |
| Communication content | Content of calls, e-mails, chat messages and SMS messages | All channels |
| Preferences | Dietary requirements, accessibility needs (if provided by you) | All channels |
| Technical data | IP address, device type (chat) | Chat |
| SMS opt-in data | Time, method and channel of consent | SMS |
3.1 Special categories of personal data
In principle, MaSolution does not process special categories of personal data as referred to in Article 9 GDPR. However, if you share dietary requirements or allergy information (which qualify as data concerning health within the meaning of Article 9 GDPR), the following applies:
- We process this data solely on the basis of your explicit consent (Article 9(2)(a) GDPR);
- the processing is strictly limited to carrying out your reservation request;
- we do not retain this data for longer than is necessary for this purpose.
Article 4 — Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) | Explanation |
|---|---|---|
| Processing reservation requests and questions | Art. 6(1)(b) — performance of a contract | Necessary to handle your request. |
| Improvement of AI models and the service | Art. 6(1)(f) — legitimate interest | Anonymised data. Not traceable to individuals. |
| Compliance with legal obligations | Art. 6(1)(c) — legal obligation | E.g. statutory retention obligation for tax purposes. |
| Recording and analysing telephone calls | Art. 6(1)(a) — consent | You are informed in advance by means of a recorded message. |
| Sending SMS messages | Art. 6(1)(a) — consent | Only after explicit opt-in. You can unsubscribe at any time by replying STOP. |
4.1 SMS communication and opt-in
MaSolution uses SMS (via Twilio Inc.) to send reservation confirmations, reminders and service notifications. We only send SMS messages if you have given your prior consent to this or if this is necessary for the performance of your reservation. You can give this consent through:
- a checkbox on our registration or booking form;
- a verbal confirmation during a telephone call (logged with a timestamp and telephone number);
- a digital opt-in via our platform.
Every SMS message we send states how you can unsubscribe. You can withdraw your consent at any time by replying STOP to an SMS message, or by contacting us at support@masolution.ai. We do not share your mobile number and opt-in data with third parties for marketing or promotional purposes.
4.2 Artificial intelligence and transparency
When you communicate through the voice assistant (Bobby), the chat function or other channels of MaSolution, you are communicating with an AI system. You are informed of this in advance. The AI output is not used for decisions with legal effects without human intervention. MaSolution thereby complies with the transparency obligations of the EU AI Act.
4.3 Legitimate interest balancing test
For processing based on legitimate interest (Article 6(1)(f) GDPR), we have carried out a balancing test. In our assessment, our interest in improving our AI models and services outweighs the possible intrusion on your privacy, because we only use anonymised and aggregated data that cannot be traced back to you. You have the right to object to this processing at any time (see article 8).
4.4 Google Business Profile data
MaSolution offers business customers (hospitality and leisure venues) the option to manage their Google Business Profile (GBP) through our platform. In that context, we process data for and on behalf of the venue concerned. The venue remains the controller of this data at all times; MaSolution acts as processor.
We process the following categories of Google Business Profile data:
| Category of GBP data | Purpose | Legal basis |
|---|---|---|
| Business profile information (name, address, opening hours, description, photos) | Managing the GBP profile and keeping it up to date on behalf of the venue | Art. 6(1)(b) GDPR — performance of the contract with the business customer |
| Customer ratings and responses (reviews) | Analysing reviews and drafting responses on behalf of the venue | Art. 6(1)(b) GDPR — performance of the contract with the business customer |
| Performance data (views, clicks, searches) | Reporting to the business customer on GBP performance | Art. 6(1)(b) GDPR — performance of the contract with the business customer |
| Messages via Google Business Profile | Answering customer questions on behalf of the venue | Art. 6(1)(b) GDPR — performance of the contract with the business customer |
Access and security: MaSolution obtains access to a venue’s Google Business Profile only after explicit authorisation by the venue via the Google API (OAuth 2.0). We do not store Google login credentials. Access tokens are stored in encrypted form and are personally tied to the authorised administrator of the venue.
Retention period: GBP-related data is retained for as long as the business customer uses our GBP management service. After termination of the contract, the data will be deleted or anonymised within 30 days, unless a statutory retention obligation applies.
No use for our own purposes: MaSolution uses Google Business Profile data of customer venues solely for the performance of the contract with that venue. We do not use this data for our own marketing purposes, profiling or any other processing outside the scope of the engagement.
Google as a third party: When the Google Business Profile API is used, the Google Privacy Policy also applies. MaSolution has entered into the required data processing agreements with Google in accordance with the Google API Services User Data Policy.
Article 5 — Retention periods
| Category of data | Retention period |
|---|---|
| Reservations and communication history | 24 months after the last interaction |
| Call recordings (voice) | 90 days, unless required for longer in connection with a complaint or dispute |
| SMS messages and opt-in records | 24 months after the last interaction, opt-in log at least 3 years |
| Technical log data | 90 days |
| Anonymised analytics data | Indefinitely (not traceable to individuals) |
| Data retained on the basis of a legal obligation | In accordance with the applicable statutory retention period |
Article 6 — Disclosure to third parties
We only share your personal data in the following cases:
- With the hospitality or leisure venue you contact (the controller): they receive your reservation information and communications in order to process your request.
- With sub-processors that provide technical services for the operation of our platform. These parties are contractually bound by strict security and privacy obligations.
- With supervisory authorities or judicial bodies, if we are legally required to do so.
- With government agencies or supervisory authorities in the event of national security requests or other legal obligations, including requests arising from national security legislation.
We never sell your personal data to third parties.
6.1 Sub-processors
An up-to-date list of our sub-processors is available on request at support@masolution.ai.
Article 7 — Transfers outside the EEA
Some of our sub-processors (see table 6.1) are established outside the European Economic Area (EEA), including in the United States. In those cases, we ensure an adequate level of protection by using the standard contractual clauses approved by the European Commission (Standard Contractual Clauses, SCCs).
Article 8 — Your rights
| Right | Explanation |
|---|---|
| Right of access | You have the right to know which personal data we process about you. |
| Right to rectification | You have the right to have inaccurate or incomplete data corrected. |
| Right to erasure | You have the right to have your data deleted, unless we are required to retain it on the basis of a legal obligation. |
| Right to restriction of processing | You have the right to have the processing of your data restricted in certain circumstances. |
| Right to data portability | You have the right to receive your data in a structured, commonly used and machine-readable format. |
| Right to object | You have the right to object to processing based on legitimate interest. |
| Right to withdraw consent | Where we process your data on the basis of consent (including SMS), you have the right to withdraw that consent at any time. |
| Right to lodge a complaint | You have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority, autoriteitpersoonsgegevens.nl). |
For requests to delete your data, you may contact us at support@masolution.ai, stating “Request for erasure of data”. We will confirm your request within 5 working days and carry out the deletion within 30 days.
To exercise a right, you may contact us at support@masolution.ai. We will respond to your request within 30 days.
8.1 Automated decision-making
MaSolution uses AI agents to process reservations, answer questions and generate suggestions. This AI processing does not result in decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. All AI suggestions are reviewed by staff of the venue concerned. You have the right to request human intervention at any time.
Article 9 — Security and data breaches
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or unauthorised disclosure. These include, among other things, encryption of data (in transit and at rest), access controls, regular back-ups and security testing.
In the event of a personal data breach, MaSolution will notify the Autoriteit Persoonsgegevens within 72 hours where required by law (Article 33 GDPR). If the data breach is likely to result in a high risk to your rights and freedoms, we will also inform you as soon as possible (Article 34 GDPR).
9.1 Data Protection Impact Assessment (DPIA)
Where required under Article 35 GDPR, MaSolution carries out a data protection impact assessment (DPIA) for processing operations that entail a high risk. This applies in particular to the use of AI processing and call recordings.
Article 10 — Cookies
Our website and the dashboard use cookies and similar technologies. Our cookie policy is available at masolution.ai/cookies. Through our cookie settings, you can give or withdraw your consent per category. Strictly necessary cookies are always placed; for analytical and other cookies, we ask for your consent in advance.
Article 11 — Changes to this privacy statement
We may update this privacy statement from time to time. The current version is always available at masolution.ai/privacy. We will announce material changes by e-mail or by means of a notification on our platform at least thirty (30) days before they take effect.
Previous versions of this privacy statement are available on request at support@masolution.ai.
Maso-IP B.V. trading as MaSolution · masolution.ai · support@masolution.ai · KvK 42024078